CVE-2009-2414

Published: Aug 11, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.

Affected (6)

Products: Xmlsoft: Libxml, Libxml2

Xmlsoft

2 products

Libxml

Libxml2

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Xmlsoft Libxml	Version 1.8.17
Xmlsoft Libxml2	Version 2.5.10
Xmlsoft Libxml2	Version 2.6.16
Xmlsoft Libxml2	Version 2.6.26
Xmlsoft Libxml2	Version 2.6.27
Xmlsoft Libxml2	Version 2.6.32

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (72)

http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2010/Jun/msg00003.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html

Source: secalert@redhat.com

http://secunia.com/advisories/35036

Source: secalert@redhat.com

http://secunia.com/advisories/36207

Source: secalert@redhat.com

http://secunia.com/advisories/36338

Source: secalert@redhat.com

http://secunia.com/advisories/36417

Source: secalert@redhat.com

http://secunia.com/advisories/36631

Source: secalert@redhat.com

http://secunia.com/advisories/37346

Source: secalert@redhat.com

http://secunia.com/advisories/37471

Source: secalert@redhat.com

http://support.apple.com/kb/HT3937

Source: secalert@redhat.com

http://support.apple.com/kb/HT3949

Source: secalert@redhat.com

http://support.apple.com/kb/HT4225

Source: secalert@redhat.com

http://www.cert.fi/en/reports/2009/vulnerability2009085.html

Source: secalert@redhat.com

http://www.codenomicon.com/labs/xml/

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1859

Source: secalert@redhat.com

Patch

http://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg678527.html

Source: secalert@redhat.com

http://www.networkworld.com/columnists/2009/080509-xml-flaw.html

Source: secalert@redhat.com

http://www.openoffice.org/security/cves/CVE-2009-2414-2416.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/36010

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-815-1

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/2420

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3184

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3217

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/3316

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=515195

Source: secalert@redhat.com

https://git.gnome.org/browse/libxml2/commit/?id=489f9671e71cc44a97b23111b3126ac8a1e21a59

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10129

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8639

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00537.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00547.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00642.html

Source: secalert@redhat.com

http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html